Skip to content
Back to

Supply chain

Production Fontana deployments consume pre-built OCI images and a verified deploy bundle from your registry (typically GHCR). CI compiles application artifacts into those images or into the deploy bundle (for example the workflow-engine dist, Convex release, and static SPA dists); production hosts pull artifacts only. That boundary supports SOC 2-aligned change management and vulnerability management without running build toolchains on customer data planes.

Artifact flow

Section titled “Artifact flow”
CI (GitHub Actions, release branch only)
  → OCI images (immutable sha-<git> / content-hash tags)
  → Deploy bundle (Helm chart, fontana CLI, SPA dists, workflow-engine dist, Convex release, SHA256SUMS)
  → Trivy CRITICAL gate
  → Host pulls bundle + images via fontana CLI

Release artifacts are built only from the protected release branch after pull-request review and required status checks pass; feature-branch pushes run tests without publishing images or bundles.

Integrity controls

Section titled “Integrity controls”
Control What you get
Immutable image tags Deploys reference sha-<git> tags; branch tags are convenience only
Bundle checksums SHA256SUMS in the deploy bundle; installer verifies before activating a release
Pinned upgrades fontana apply reconciles every YAML tenant to a pinned bundle tag; deploy snapshot when the release changes
Rollback fontana rollback <tenant> [kind/name] restores data and release state from a GFS snapshot
Artifact-only production hosts Production hosts pull digest-pinned OCI images and the deploy bundle; no git or build toolchain on the data plane
Workflow-engine dist in bundle Engine code ships as a content-hashed folder in the bundle and mounts into the workflow-engine pod; the image holds Node runtime and npm deps only, so engine-only changes avoid a full image rebuild
Convex release in bundle Convex source, declared workspace packages, and seed content ship as a content-hashed folder mounted into the deploy Job; the convex-deploy image holds Node runtime and npm deps only, so Convex-only changes avoid a full image rebuild

Vulnerability management

Section titled “Vulnerability management”

CI runs Trivy against built images. CRITICAL findings fail the pipeline until remediated or explicitly waived under your change process. That gate is part of the SOC 2-aligned supply-chain control set documented for diligence.

Source dependencies are gated on the same pipeline:

  • pnpm audit fails the build on any high or critical advisory in the dependency tree
  • CodeQL static analysis runs on every push and pull request to the release branch
  • Dependabot keeps lockfile and GitHub Actions dependencies current
  • A public-function inventory diff fails the build when the backend API surface changes without a reviewed baseline update

Change control and audit trail

Section titled “Change control and audit trail”
  • Manual pinned releases on production hosts reference immutable sha-<git> tags
  • Automatic full-stack deploy snapshot when fontana apply changes the bundle release and snapshots.on_apply is true (GFS retention in fontana.yaml)
  • Terraform for host provisioning; durable platform changes reconcile through fontana apply and infrastructure as code

Snapshot history on the host plus immutable GHCR tags form the deploy audit trail alongside application security audit in ImmuDB.

Section titled “Related documentation”